Authorised push payment (“APP”) fraud allegations involve a third-party bad actor fraudulently inducing a bank customer to give authorised instructions to their bank to make a payment to the third-party (or someone connected with them). APP fraud often takes place through schemes that convince victims to make payments for goods or services which are never received, to transfer money for romantic reasons or to transfer money to accounts controlled by individuals impersonating someone the victim trusts.

The key difference between APP fraud and other forms of fraud on bank customers, such as those carried out by a wrongdoing agent or a hacker (also known as ‘pull payment’ fraud), is that the relevant payment instruction is authorised by the alleged victim. Victims instruct the bank to carry out the transfer genuinely intending that the transfer be made.

In a highly anticipated judgment,^[1] the UK Supreme Court has firmly rejected an attempt to extend the so-called Quincecare duty on banks in such a way as to require them to watch out for and prevent APP fraud. Prior to this case (and now as a result of it) the so-called Quincecare duty requires banks not to carry out a payment instruction without first making inquiries in circumstances where there are reasonable grounds for believing that instructions provided by a customer’s agent are an attempt to misappropriate the customer’s funds.

In this case, a bank’s customer had argued that the Quincecare duty required the bank not to act on the customer’s valid and intended direct instructions without first making inquiries, in circumstances where there were reasonable grounds for believing that the customer was being defrauded by a third party. However, the Court held that the duty has no application where a valid payment instruction is given by the customer themself, even where that payment results in the misappropriation of the customer’s funds.

The decision therefore confines the duty to situations where payment instructions are given by a customer’s agent. It also further clarifies the law in this area by making clear that the Quincecare duty is not a special or newly developed duty but rather an incident of the bank’s general duty of skill and care owed to its customer and a consequence of the fact that an agent cannot have apparent authority to defraud their principal.

This should serve to allay concerns that banks may have previously had that the Quincecare duty applies even where valid instructions are given by customers directly, as that could place an excessive burden on their day-to-day operations and greatly expand the scope of their potential liability to customers.

More generally, legislative changes, including the retained Payment Service Regulations 2017 and the new Financial Services and Markets Act 2023, are increasingly replacing existing common law duties in this area with new regulatory obligations. As a result, notwithstanding the Supreme Court’s decision to limit the scope of the duty, the so-called Quincecare duty may become increasingly redundant in any event.

Background

The Claimant was the victim of an “egregious” APP fraud, by which she was deceived into instructing her bank to make two payments totalling £700,000 out of her life savings to two foreign bank accounts based in the UAE. The bank had followed up with her to check that she had requested the payments and still wished to proceed. Indeed, the Claimant and her husband were so adamant that the payments should be made that the husband falsely told the bank that he had had prior dealings with the payee.

Unable to recover the money from the perpetrators of the fraud, the Claimant instead sought to recover her money from the bank, claiming in particular that the bank knew or ought to have known that the Claimant was being defrauded such that complying with the Claimant’s instructions without first making inquiries had amounted to a breach of the bank’s Quincecare duty. The Claimant further argued that the bank had also breached its duty by not acting promptly enough in taking steps to recall the payments, once the bank became aware of the fraud and had frozen her account.

The bank was granted summary judgment at first instance on the basis that the Quincecare duty does not extend to circumstances where instructions were validly given by the customer directly herself.

However, the Court of Appeal allowed the Claimant’s appeal, finding that, in theory at least, the Quincecare duty was capable of applying more broadly to circumstances where there are reasonable grounds to believe that a customers’ valid and authorised instruction would result in the fraudulent misappropriation of their funds.

The Decision

The primary issue before the Supreme Court in Philipp was whether the so-called Quincecare duty requires a bank not to carry out a valid payment instruction issued directly by the customer without first making inquiries where there are reasonable grounds to believe that the customer is being defrauded.

The Court held that this duty has no application where a valid payment instruction is given by the customer herself, even where that payment results in the misappropriation of the customer’s funds.

In the present case, payment instructions were not given by an agent, but by the customer in person at a branch. In addition, the bank had on each occasion, telephoned the Claimant to confirm that she had in fact issued the instruction and wished to proceed with the payment, so there could be no question that the instructions were valid and the bank was acting within its mandate.

The Court also rejected an argument that the duty applied to any transaction where a customer has been fraudulently induced to give instructions which do not reflect the customer’s true, genuinely held intention—a mistaken belief as to the recipient or purpose of the payment does not make the intended instructions any less real or genuinely held.

On these bases, the Court held that there could be no breach of the so-called Quincecare duty and the bank was therefore entitled to summary judgment in this respect and its appeal allowed.

The Claimant argued alternatively that the bank breached its duty of care by failing to take steps to recover the misappropriated funds sooner than it did. The Court noted that until at least when the Claimant herself notified the bank that she had been the victim of a fraud, the bank had no authority (less still obligation) to attempt to recall payments already made, as that would have contradicted her direct payment instructions. Although the Court expressed scepticism as to the Claimant’s prospects of establishing a materially greater chance of recovering the misappropriated funds if action had been taken by the bank sooner, it decided that the matter could not be determined at the summary judgment stage. The Claimant would be permitted to proceed with this aspect of her claim before the High Court.

What is the True Basis for the Quincecare Duty, and what are its Limits?

In Philipp, the Supreme Court considered at some length the origins of the so-called Quincecare duty and clarified its nature and scope.

The Court’s reasoning started with the basic propositions of banking law that:

• a bank acts as its customer’s agent in carrying out payment instructions (the bank’s “mandate”)

• in doing so, the bank owes a strict duty promptly to make payments in compliance with the mandate, and not to make payments that the customer has not authorised (it is “not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions”); and

• a bank also owes a limited duty of reasonable skill and care in “interpreting, ascertaining and acting in accordance with instructions” from its customers.

The Court made clear that the so-called Quincecare duty was not a “special or idiosyncratic rule of law” but merely the logical application of agency law and a bank’s existing implied contractual duties. In particular, it is an application of the bank’s general duty of skill and care in circumstances where it is not yet clear whether there is a valid payment instruction given by an agent on behalf of a customer (and where such circumstances are not covered by the express terms of the bank/customer contract).

The rationale for this is that a bank can avoid liability if it shows that a payment was made on the basis of instructions given by an agent of the customer with actual or apparent authority to give the payment instructions on the customer’s behalf. However, the agent of a customer cannot, as a matter of law, have authority from the customer to defraud the customer for the agent’s own benefit^[2] and the bank is not entitled to rely on any apparent authority from the agent without first making reasonable enquiries, where it is unreasonable to so rely (i.e., where it appears the payment may be fraudulent). In those circumstances, a bank has a duty not to execute the payment instruction without first making reasonable inquiries to ensure the payment has been authorised by the customer. If it fails to do so, the bank will be in breach of its duty of reasonable skill and care and acting outside its mandate.

It follows that where a customer’s payment is induced by an APP fraud, the so-called Quincecare duty has no application. That is because in that scenario, the customer gives a clear and valid instruction to the bank and there is no agent perpetrating a fraud on the customer. Therefore, the bank is acting within its mandate and (provided the bank carries out the instruction promptly and correctly) no issue around the duty of skill and care arises:

“Provided the instruction is clear and is given by the customer personally or by an agent acting with apparent authority, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction and any refusal or failure to do so will prima facie be a breach of duty by the bank.”^[3]

An Alternative Limitation on Banks’ duties

The Court left open for consideration on another occasion the scope of a potential further limitation on a bank’s duty to carry out a customer’s valid payment instructions where the bank knows or ought to know that the customer would not want their instructions to be carried out, were they aware of circumstances that are known to the bank.

In this case, however, the Court noted that the Claimant and bank were aware of the same information: the Claimant knew that the payments were unprecedented, unusually large in amount, made to a bank account in the UAE, and that the accounts were operated by companies with which the Claimant had had no prior dealings. There was therefore no basis for arguing that the Defendant had material information relating to the transactions that was not known to the Claimant.

Comment

APP fraud has become an increasingly concerning problem in the UK financial sector, causing nearly £500m in losses in 2022 alone. In reaching its decision, the Supreme Court emphasised that whether, and if so to what extent, the victims of APP fraud should be left to bear their losses or whether they should be reimbursed (wholly or in part) by banks was not a matter for the Courts, but ultimately a policy question for regulators, government and Parliament to consider.

The Court noted in this regard that the Financial Services and Markets Act 2023 has already provided for a mandatory reimbursement scheme, which will introduce new requirements regarding the reimbursement of consumers, charities and ‘micro-enterprises’ who have fallen victim to APP fraud perpetrated through the Faster Payments Scheme (notably, therefore, the requirements do not apply to international payments). Once the requirements come into force (which is expected to be in 2024), such victims would be reimbursed, with the cost borne 50:50 by the paying and receiving banks.

As to the so-called Quincecare duty itself, as the Court was clear that it is not a special or standalone duty, it is, in reality, little more than a convenient shorthand for the application of conventional legal principles in the context of fraudulent payment instructions issued by an agent. As a result of the confinement of the ‘duty’ in this way and continued legislative encroachment in this area, such as under Part 7 of the Payment Services Regulations 2017, the ‘duty’ may fall into disuse.

As noted, the Court has left open the possibility of recovery for customers from banks in other circumstances, in particular, where a bank proceeds with a payment where it is aware of material facts that are unknown to the customer that would likely mean the customer would not wish to make the payment. However, such a scenario may be unlikely to arise in practice because banks’ standard terms (such as those in Philipp) typically permit them not to carry out instructions where they reasonably believe the payment is connected with a fraud or other criminal activity and, generally, banks will freeze the relevant account(s) once they have that belief (as the bank did in Philipp). Such liability for banks may therefore arise only in very rare cases, if any, where they possess specific information, other than concerning a fraud, that indicates that the customer would likely not wish to make the payment if it were aware of what the bank knows.

The Supreme Court’s judgment did not elucidate the type and extent of information that will engage the duty (as opposed to any express right) not to carry out the relevant payment instruction if a bank becomes aware of a possible fraud that its customer does not yet know about. It therefore appears the courts may be called upon in due course to strike an appropriate balance between a bank’s duty promptly to process a customer’s payment instructions with the need to prevent fraudulent payments in this scenario. It is this type of policy-based balancing exercise that the Court sought to avoid when it recast the Quincecare duty in Philipp.

The Court gave similarly limited guidance on when a bank’s duty to attempt to claw back payments may be triggered. In particular, it has left open the question as to whether a customer’s notification to a bank of a possible fraud is sufficient to oblige the bank from that point in time to take steps to recall the funds, or whether an express instruction to that effect is required. These questions will need to be addressed in this case if and when it comes back before the High Court.

The Court’s clarification of the Quincecare duty will be welcomed by banks concerned about the potentially significant extension to their duties to customers that might have resulted from Philipp. However, it has also left open a few other potentially important questions regarding a bank’s alleged duties to protect its customers from fraud. As the scale and impact of such fraud continues to grow, it may be only a matter of time before the courts are required to consider these questions further.

Footnotes

[1] Philipp v Barclays Bank UK PLC [2023] UKSC 25

[2] An unsurprising proposition, albeit there remains the extremely unlikely possibility that a customer might give express authority to its agent to make payments defrauding the customer.

[3] Philipp v Barclays Bank UK PLC [2023] UKSC 25, at para 100.

[View source.]